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(54) Random number generating apparatus 

(57) A random number generating apparatus which 
is suitable for miniaturization and which can easily gen- 
erate binary random numbers that are cryptographically 
secure is provided. The apparatus comprises: a semi- 
conductor device having a junction; reverse bias apply- 



ing circuit for applying a reverse bias voltage of a degree 
so as to cause a breakdown current in the junction; and 
a binarizing circuit for binarizing a noise signal created 
in a current path including said junction for generating 
random numbers from the binarlzed signal. 
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Description 

[0001] The present invention rotates to a random 
number generating apparatus, more particularly, to a 
random number generating apparatus that is used as a s 
random number source for an encryption algorithm. 
[0002] In association with the development of the In- 
temet and Intranet, new market areas such as interna- 
tional transactions, transactions among different indus- 
tries, electronic data interchange (EDI), and the like are io 
being actively exploited. Due to openness of the Inter- 
net, it is necessary to take countermeasures against il- 
legal acts (tapping, falsification, pretending, destructive 
action, and the like) on information signals transmitted 
and received in communication networks. Development 
of a security technique is urgently demanded. 
[0003] Encryption technology is widely used to assure 
the security of communication networks. For example, 
there is a digital signature algorithm (DSA) standardized 
in the U.S. In encryption devices employing such an al- 20 
gorithm, it is necessary to generate random numbers 
each time a signature is generated. Random numbers 
to be used in the devices are desirable to be •informa- 
tion-theoretical ty (cryptograph icalfy) secure". 
[0004] The 'cryptographically secure' random num- 2s 
bers denote random numbers which satisfy a condition 
such thai 'other bits cannot be estimated from an arbi- 
trary part of a random number sequence with a proba- 
bility of more than 50%". Shce the condition is very 
strict, however, the following evaluation measures may &> 
practically be used. That is, 

(1 ) equality between occurrence frequency of 0 and 
that of 1, 

(2) long periodicity, 35 

(3) non-linearity, 

(4) high linear complexity, and 

(5) non-correlation. 

[0006] These are necessary conditions. Non-linearity to 
denotes that random numbers are not an output itself of 
a linear feedback shift register. The maximum period of 
a sequence which can be generated by linear feedback 
shift registers of n stages is equal to 2" - 1. The se- 
quence of the period 2 n - 1 is called an M sequence *s 
(maximum length shift register sequence). The M se- 
quence, therefore, which is often used as pseudo-ran- 
dom numbers does not satisfy the non-linearity condi- 
tion. 

[0006] The linear complexity of the random number so 
sequence denotes the minimum and equivalent number 
of stages of the linear feedback shift registers to gener- 
ate the sequence. In case of the M sequence with the 
period 2" - 1 as an example, since It is a sequence of 
the maximum period that is generated by the linear feed- ss 
back shift registers of n stages, the linear complexity of 
the M sequence is equal to n. When the linear complex- 
ity is low, an equivalent random number generator can 



be readily constructed. Thus the random numbers of low 
linear complexity cannot be cryptographically secure, 
since unknown bits are easily predicted. 
[0007] ^-correlation denotes that, for example, the 
bits in a portion of random numbers are independent 
from those of the other portions. When there is a corre- 
lation, on the contrary, unknown bits can be easily esti- 
mated. 

[0008] Hitherto, as a random number source of the 
encryption algorithm, pseudo-random numbers have 
generally been used. The pseudo-random numbers, 
however, cannot be cryptograph tally secure in view of 
the above-mentioned evaluation measures. That is, 
since the pseudo-random numbers are generated by a 
certain arithmetic process or a combination of functions, 
the same random numbers can be generated by giving 
the same initial conditions. An encryption method using 
the pseudo-random numbers can be, therefore, easily 
predicted and the generated cipher readily deciphered. 
It is insufficient in terms of ensuring security. 
[0009] As a method of generating random numbers 
that is close to truly* random numbers, there is an ap- 
paratus utilizing a natural phenomenon, for example, a 
decay of a radioactive material or the like. It has, how- 
ever, a drawback that the apparatus is large and com- 
plicated. 

[001 0] Thus, a random number generating apparatus 
of compact size which achieves high security and can 
be easily assembled in a personal computer or the like 
is therefore demanded. 

[0011] The invention is made in consideration of the 
aforementioned drawbacks and it is an object to provide 
a random number generating apparatus and the method 
for generating binary random numbers which are cryp- 
tographically secure and is adapted for miniaturization. 
[0012] A random number generating apparatus ac- 
cording to the present invention comprises: a semicon- 
ductor device having a junction; reverse bias applying 
circuit for applying a reverse bias voltage of a degree so 
as to cause a breakdown current In the junction; and a 
binarizing circuit for binarizing a noise signal created in 
a current path including said junction for generating ran- 
dom numbers from the binarized signal. 
[001 3] In the accompanying drawings: 

Fig. 1 is a diagram showing a configuration of a ran- 
dom number generating apparatus according to the 
first embodiment of the present invention; 
Fig. 2 illustrates the operation of the random 
number generating apparatus shown in Fig. 1; 
Fig. 3 is a diagram showing a configuration of a ran- 
dom number generating apparatus according to the 
second embodiment of the present invention; and 
Fig. 4 is a diagram showing a configuration of a ran- 
dom number generating apparatus according to the 
third embodiment of the present invention. 

[0014] Embodiments of the invention will be de- 
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scribed in detail hereinbelow with reference to the draw- 
ings. 

[0015] Fig. 1 schematically shows a configuration of 
a random number generating apparatus according to 
the first embodiment of the present Invention. Rg 2 il- 
lustrates the operation of the random number generat- 
ing apparatus shown in Fig. 1 . 
f 001 6] In Fig. 1 , reference numeral 5 denotes a noise 
generating circuit. A reverse bias voltage at which a 
slight amount of breakdown occurs is applied to a pn 
junction of a Zener diode a via a resistor 11. A feeble or 
weak breakdown current consequently flows in the re- 
verse direction and random noise voltages are generat- 
ed. By making the Zener diode 8 operative as mentioned 
above, a random noise voltage output of about tens to 
hundreds uV as peak-to-peak voltages around a Zener 
voltage is generated. The generated random noise volt- 
age can be used as a generating source of the random 
numbers 

[0017] Specifically, a power voltage Vcc is set to + 12V 
and a Zener diode 8 having a Zener voltage of 6 3V, 
which is equal to about 1/2 of the powervoltage, is used.' 
[001 6] By applying a reverse bias voltage to the Zener 
diode 8 via the resistor 11 having a resistance of 560 
ka a reverse current of about 10 uA flows within the 
diode. Noise voltage signal having a peak-to-peak volt- 
age of 20 uV around 6. 3V and an average frequency of 
approximately 60 to 70 kHz is generated (reler to Fig 2 
(a)). 

[001 0] Since the noise voltage signal generated in the 
noise generating circuit 5 is feeble or weak, the signal 
is amplified in an amplifying circuit 15. Specifically, op- 
erational amplifiers of two stages are used in the ampli- 
fying circuit 15. A voltage gain of the amplifying circuit 
15 is about 74 dB and an amplified signal with a peak- 
to-peak voltage of about 1V around 6.3V can be ob- 
tained (refer to Fig. 2(b)). 

[0020] The noise signal amplified in the amplifying cir- 
cuit 1 5 is supplied to a low pass filter 17 in which a high 
frequency component is removed. A cut-off frequency 
of the low pass filter 1 7 may be about a few times as 
high as a sampling frequency, as will be described later. 
An output signal of the tow pass filter 17 is supplied to 
a comparison circuit 21. The comparison circuit 21 de- 
termines whether the supplied signal is higher or lower 
than a predetermined threshold value, thereby obtahing 
a binarized 9ignal. 

[0021] Since the amplified noise output of the ampli- 
fying circuit 15 is almost symmetrical with respect to the 
Zener voltage of 6.3V, the amplified noise voltage signal 
can be binarized by using the Zener voltage as a refer- 
ence. In the embodiment, a ground voltage is used as 
a reference since the voltage is very stable. That is, by 
using a coupling capacitor 19, an AC component ob- 
tained by cutting out a DC component in the amplified 
noise signal is supplied to the comparison circuit 21 (re- 
fer to Fig. 2(c)). The binarization process using the 
ground voltage (0V) as a threshold value can be conse- 



quently performed. In the configuration, even when the 
Zener voltage varies due to a temperature change, only 
the DC component varies. The binarization process is 
not influenced by the Zener voltage change at all. The 
* peak-to-peak voltage around 0V of the AC component 
in the amplified noise signal is about 1 V. The AC com- 
ponent is supplied to an input terminal of the comparison 
circuit 21 and the binarization process using 0V of the 
ground voltage as a threshold value is performed 
" [0022] An output signal of the comparison circuit 21 
is supplied to a level converting circuit 23 and is con- 
verted into a logical voltage level of a sampling circuit 
25 at the post stage. 

j?023] An output signal of the level converting circuit 
16 23 is a random rectangubr wave having no periodicity 
(refer to Fig. 2(d)). The rectangular wave Is supplied to 
the sampling circuit 25. 

[0024] The sampling circuit 25 samples the input rec- 
tangular wave with a predetermined frequency which is 
lower than the frequency of the input rectangular wave 
for example, a few tenths of the frequency of the input 
rectangular wave or lower, thereby obtaining a se- 
quence consisting of bits of 0 and 1 . Since the input rec- 
tangular wave has no periodicity and a sampling trning 
& is independent of the frequency of the input rectangular 
wave, if an occurrence probability of 0 and of 1 of the 
obtained bit sequence are equal, it can be expected that 
the sequence is a truly random number sequence. 
[0026] The truly random number sequence consisting 
*> of Oand 1 obtained by the sampling circuit 25 is supplied 
to an external device, for example, an encryption device 
through an external interface (not shown) such as an 
RS-232C interface or the like. The sampling frequency 
needs to be set to a bit rate required by the external 
device. 

[0026] As mentioned above, according to the present 
invention, by using the noise signal which occurs when 
a reverse bias voltage with an approximate magnitude 
of a breakdown voltage is applied to the semiconductor 
40 lection as a generating source of random numbers, bi- 
nary truly-random numbers can be easily generated. 
Since the circuit can be easily provided in the form of an 
IC, a random number generating apparatus of very 
small size can be realized. 
46 [0027] By assembling the present apparatus as a tru- 
ly random number generating engine' into, for example, 
a personal computer or the like, truly random numbers 
(physical random numbers)' for generating a signature 
using the digital signature algorithm can be provided. 
so That is, communications with much higher security than 
that in a conventional case using pseudo-random num- 
bers can be performed. 

[0028] Fig. 3 shows a configuration of a random 
number generating apparatus according to the second 
55 embodiment of the present invention. 

[0029] The second embodiment differs from the first 
embodiment in that a control unit 31 is provided so as 
to control the equal occurrence probabilities of 0 and 1 
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of the obtained random number sequence. 
[0030] That is, the control unit 31 obtains an output 
signal of the sampling circuit 25 and controls a reference 
voltage Vref which is applied to the comparison circuit 
21 so that an accumulation value of the duration period 
of the high level voltage and that of the duration period 
of the low level voltage in the output are equalized. 
[0031] By providing the control unit 31 for controlling 
the reference voltage Vref, the occurrence probabilities 
of 0 and 1 in the random number sequence of the ran- 
dom number generating apparatus can be equalized. A 
binary random number sequence which can be regard- 
ed to be truly random is obtained. 
[0032] Fig. 4 shows a configuration of a random 
number generating apparatus according to the third em- 
bodiment of the present invention. 
[0033] The third embodiment differs from the first and 
second embodiments in that a smoothing unit 35 for per- 
forming a smoothing process so as to equalize the oc- 
currence probabilities of 0 and 1 in the random number 
sequence obtained by the sampling circuit 25 is provid- 
ed at the post stage of the sampling circuit 25. 
[0034] When it is assumed that an imbalance se- 
quence of 0 and 1 is x,. x 2 , x 3 the smoothing oper- 
ation can be performed by using 

y = x 1 ©x 2 © ... ©x n 

where. © denotes an arithmetic operation indica- 
tive of the sum (exclusive OR) using modulo 2. It is 
shown that the sequence of V thus obtained Is im- 
proved in terms of imbalance. That is. it is now assumed 
that an occurrence probability of 0 in the sequence of 
*i. Xg, x 3 , .... is labelled to 'p", an occurrence probability 
of 1 is set to (q = 1 - p), an appearing probability of 0 
with respect to y is labelled to T\ and an appearing 
probability of 1 Is set to (Q = 1 - P). The imbalance of 
'y* is given by 



used as a noise generating source. 
[0037] As described above in detail, according to the 
present invention, by using the breakdown current of the 
semiconductor junction as a noise generating source. 
5 to* random number generating apparatus which can 
easily generate the binary random numbers that are 
cryptograph icaily secure and is suitable for miniaturiza- 
tion can be realized. 
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Claims 

1. A random number generating apparatus compris- 
ing: 

a semiconductor device having a junction; 
reverse bias applying circuit for applying a re- 
verse bias voltage of a degree so as to cause 
a breakdown current in said junction; and 
a binarizing circuit for binarizhg a noise signal 
created in a cunent path including said junction 
for generating random numbers from the bha- 
rized signal. 



& 2. An apparatus according to claim 1, wherein said 
semiconductor device is a Zener diode. 

3. A random number generating apparatus compris- 
ing: 



35 



40 



P-Q = (p-q) ft 

where, V is a block size in the smoothing operation. 
When V is set to a large value, the Imbalance becomes 
exponentially smaller. 

[0035] Although the smoothing unit 35 has been ex- 
plained as a configuration of hardware in Fig. 4. it can 
be easily realized in practice by software of a computer. 
It is sufficient to perform the smoothing operation in a 
scale (i.e., size of a block) required by a computer. By 
performing the foregoing process, the sequence of 0 
and 1 which can be truly random can be obtained. 
[0036] Although the case of using the Zener diode as 
a noise generating source has been described in the 
embodiments, the invention is not limited to the case. 
For example, a semiconductor junction of a hetero-junc- 
tion may be employed and its breakdown current can be 



a semiconductor device having a junction; 
reverse bias applying circuit for applying a re- 
verse bias voltage to said junction so as to 
cause a breakdown current in said junction; 
amplifying circurt for amplifying a noise signal 
created in a current path including said junc- 
tion; 

comparison circuit for comparing the amplified 
signal with a predetermined reference voltage 
for obtaining a binary signal; and 
sampling circuit for sampling said binary signal 
for obtaining a sampling value sequence con- 
sisting of 0 and 1. 

4. An apparatus according to claim 3, wherein said 
semiconductor device is a Zener diode. 

5. An apparatus according to claim 3. further compris- 
ing: a control circuit for controlling said reference 

50 voltage so as to substantially equalize an occur- 
rence probability of 0 and 1 in said sampling value 
sequence. 

6. An apparatus according to claim 3. further compris- 
55 ing: a smoothing circuit for smoothing said sampling 

value sequence so as to substantially equalize an 
occurrence probability of 0 and 1 in said sampling 
value sequence. 
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7. An apparatus according to claim 4, further compris- 
ing: a control circuit for controlling said reference 
voltage so as to substantially equalize an occur- 
rence probability ot 0 and 1 in said sampling value 
sequence. 5 

a An apparatus according to claim 4, further compris- 
ing; a smoothingcircult for smoothing said sampling 
value sequence so as to substantially equalize an 
occurrence probability of 0 and 1 in said sampling io 
value sequence. 

9. A method for generating random numbers, compris- 
ing the steps of: 

1S 

utilizing a semiconductor device having a junc- 
tion; 

applying a reverse bias voltage to said junction 
and causing a breakdown current in said junc- 
tion; and 20 
binarizing a noise signal created in a current 
path including said junction for generating ran- 
dom numbers from the binarized siyial. 

10. A method according to claim 9, including: 2$ 
utilizing a Zener diode as said semiconductor 
device. 



15. A method according to claim 1 2, further comprising 
a step of controlling said reference voltage and sub- 
stantially equalizing an occurrence probability of 0 
and 1 in said sampling value sequence. 

1 6. A method according to claim 1 2, further comprising 
a step of smoothing said sampling value sequence 
and substantially equalizing an occurrence proba- 
bility of 0 and 1 in said sampling value sequence. 



1 1 . A method for generating random numbers, compris- 
ing the steps of; & 

utilizing a semiconductor device having a junc- 
tion; 

applying a reverse bias voltage to said junction 
and causing a breakdown current in said iunc- 3$ 
ton; 

amplifying a noise signal created in a current 
path including said junction; 
comparing the amplified signal with a predeter- 
mined reference voltage and obtaining a binary 40 
signal; and 

sampling said binary signal and obtaining a 
sampling value sequence consisting of 0 and 1 . 

ifc A method according to claim 11 , including: 46 
utilizing a Zener diode as said semiconductor 
device. 



1 3. A method according to claim 1 1 , further comprising 

a step of controlling said reference voltage and sub- so 
stantially equalizing an occurrence probability of 0 
and 1 in said sampling value sequence. 

14. A method according to claim 11 , further comprising 

a step of smoothing said sampling value sequence ss 
and substantially equalizing an occurrence proba- 
bility of 0 and 1 in said sampling value sequence. 
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